Critical Patch available CVSS up to 9.8
Siemens RUGGEDCOM CROSSBOW access controller has SQLite flaws; update available
CISA ICS AdvisoriesSiemens · Critical Manufacturing, Transportation Systems, EnergyCVE-2025-6965, CVE-2025-70873, CVE-2025-71316
What happened. The SQLite component inside RUGGEDCOM CROSSBOW Station Access Controller has multiple flaws. An attacker could run code, cause a denial of service or obtain sensitive information. Siemens released a new version and recommends updating.
Who is affected. Siemens RUGGEDCOM CROSSBOW Station Access Controller (SAC) versions before 6.0. Sectors named include critical manufacturing, transportation, energy, healthcare, financial services and government facilities.
What to do. Update RUGGEDCOM CROSSBOW SAC to version 6.0 or later, as recommended by Siemens.
Editor's reading
Forasset ownerOT security lead
- Purdue level
- L3
Why: CROSSBOW Station Access Controller is an access-management product for remote access to station devices, which suggests a site operations or access role at level 3.
- Are you exposed?
Search the asset inventory for RUGGEDCOM CROSSBOW Station Access Controller installations and check that the version is 6.0 or later.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: CISA ICS Advisories (opens cisa.gov)
More on Siemens Manufacturing Transport Energy and power CVE-2025-6965 CVE-2025-70873 CVE-2025-71316